{
    "name": "1PasswordCCPDefinition",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "availability": {
        "isPreview": true
    },
    "properties": {
        "connectorUiConfig": {
            "title": "1Password (Serverless)",
            "publisher": "1Password",
            "id": "1PasswordCCPDefinition",
            "descriptionMarkdown": "The 1Password CCP connector allows the user to ingest 1Password Audit, Signin & ItemUsage events into Microsoft Sentinel.",
            "graphQueriesTableName": "OnePasswordEventLogs_CL",
            "graphQueries": [
                {
                    "metricName": "Total Sign In Attempts received",
                    "legend": "SignIn Attempts",
                    "baseQuery": "{{graphQueriesTableName}} | where log_source == 'signinattempts'"
                },
                {
                    "metricName": "Total Audit Events received",
                    "legend": "Audit Events",
                    "baseQuery": "{{graphQueriesTableName}} | where log_source == 'auditevents'"
                },
                {
                    "metricName": "Total Item Usage Events received",
                    "legend": "Item Usage Events",
                    "baseQuery": "{{graphQueriesTableName}} | where log_source == 'itemusages'"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Get Sample of 1Password events",
                    "query": "{{graphQueriesTableName}}\n | take 10"
                }
            ],
            "dataTypes": [
                {
                    "name": "OnePasswordEventLogs_CL",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(7d) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "1Password API token",
                        "description": "A 1Password API Token is required. See the [1Password documentation](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens) on how to create an API token."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "title": "STEP 1 - Create a 1Password API token:",
                    "description": "Follow the [1Password documentation](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens) for guidance on this step."
                },
                {
                    "title": "STEP 2 - Choose the correct base URL:",
                    "description": "There are multiple 1Password servers which might host your events. The correct server depends on your license and region. Follow the [1Password documentation](https://developer.1password.com/docs/events-api/reference/#servers) to choose the correct server. Input the base URL as displayed by the documentation (including 'https://' and without a trailing '/')."
                },
                {
                    "title": "STEP 3 - Enter your 1Password Details:",
                    "description": "Enter the 1Password base URL & API Token below:",
                    "instructions": [
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "Base Url",
                                "placeholder": "Enter your Base Url",
                                "type": "text",
                                "name": "BaseUrl"
                            }
                        },
                        {
                            "type": "Textbox",
                            "parameters": {
                                "label": "API Token",
                                "placeholder": "Enter your API Token",
                                "type": "password",
                                "name": "ApiToken"
                            }
                        },
                        {
                            "type": "ConnectionToggleButton",
                            "parameters": {
                                "connectLabel": "connect",
                                "name": "connect"
                            }
                        }
                    ]
                }
            ]
        }
    }
}